CVE-2024-5257: Improper Access Control in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with admincomplianceframework custom role may have been able to modify the URL for a group namespace.
Other sources
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with admincomplianceframework custom role may have been able to modify the URL for a group namespace. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N, 4.9). It is now mitigated in the latest release and is assigned CVE-2024-5257.
— GitLab
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.4Fixed in 17.1.2 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.0.4 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.1.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-5257
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the risk associated with CVE-2024-5257?
CVE-2024-5257 allows a Developer user with the `admin_compliance_framework` role to modify the group namespace URL, potentially leading to unauthorized access or manipulation of group settings.
How can I resolve CVE-2024-5257?
To fix CVE-2024-5257, update your GitLab instance to version 17.0.4 or 17.1.2 or later.
Which versions of GitLab are affected by CVE-2024-5257?
CVE-2024-5257 affects GitLab CE/EE versions from 17.0.0 up to, but not including, 17.0.4 and from 17.1.0 up to, but not including, 17.1.2.
Is CVE-2024-5257 critical?
The severity of CVE-2024-5257 is significant due to the potential for unauthorized URL modification by users with specific roles.
What user role is specifically mentioned in CVE-2024-5257?
CVE-2024-5257 specifically mentions the `admin_compliance_framework` custom role as being able to exploit the vulnerability.